CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,359 CVEs
1,730 on KEV
17,275 EPSS ≥ 10%
25,087 with exploits
synced 2026-10-01
186,200 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-4557 EXP | plugins/wacko/highlight/html.php in Strawberry in CuteNews.ru 1.1.1 (aka Strawberry) allows remote attackers to execute arbitrary PHP code via the tex… | Patch early | 10.0 high | 45.3% | 2008-10-14 |
| CVE-2011-5046 EXP | The Graphics Device Interface (GDI) in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vis… | Patch early | 9.3 high | 45.3% | 2011-12-30 |
| CVE-2018-15535 EXP | /filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restri… | Patch early | 7.5 high | 45.2% | 2018-08-24 |
| CVE-2020-35313 EXP | A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attack… | Patch early | 9.8 critical | 45.2% | 2021-04-20 |
| CVE-2011-2386 EXP | VisiWaveReport.exe in AZO Technologies, Inc. VisiWave Site Survey before 2.1.9 allows user-assisted remote attackers to execute arbitrary code via a (… | Patch early | 9.3 high | 45.2% | 2011-06-08 |
| CVE-2013-0209 EXP | lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration func… | Patch early | 7.5 high | 45.2% | 2013-01-23 |
| CVE-2024-48760 EXP | An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlc… | Patch early | 9.8 critical | 45.1% | 2025-01-14 |
| CVE-2024-42640 EXP | angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allow… | Patch early | 9.8 critical | 45.1% | 2024-10-11 |
| CVE-2008-5789 EXP | Multiple PHP remote file inclusion vulnerabilities in the Recly Interactive Feederator (com_feederator) component 1.0.5 for Joomla! allow remote attac… | Patch early | 7.5 high | 45% | 2008-12-31 |
| CVE-2007-0927 EXP | Heap-based buffer overflow in uTorrent 1.6 allows remote attackers to execute arbitrary code via a torrent file with a crafted announce header. | Patch early | 7.5 high | 45% | 2007-02-14 |
| CVE-2022-0332 EXP | A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching u… | Patch early | 9.8 critical | 44.9% | 2022-01-25 |
| CVE-2018-8619 EXP | A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific c… | Patch early | 7.5 high | 44.8% | 2018-12-12 |
| CVE-2008-0144 EXP | PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 7.5 high | 44.8% | 2008-01-08 |
| CVE-2003-0150 EXP | MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator t… | Patch early | 9.0 high | 44.8% | 2003-03-24 |
| CVE-2015-5550 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 44.8% | 2015-08-14 |
| CVE-2015-5551 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 44.8% | 2015-08-14 |
| CVE-2015-5556 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 44.8% | 2015-08-14 |
| CVE-2015-5557 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 44.8% | 2015-08-14 |
| CVE-2015-5561 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 44.8% | 2015-08-14 |
| CVE-2019-8341 EXP | An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" paramet… | Patch early | 9.8 critical | 44.8% | 2019-02-15 |
| CVE-2007-6165 EXP | Mail in Apple Mac OS X Leopard (10.5.1) allows user-assisted remote attackers to execute arbitrary code via an AppleDouble attachment containing an ap… | Patch early | 9.3 high | 44.7% | 2007-11-29 |
| CVE-2003-0469 EXP | Buffer overflow in the HTML Converter (HTML32.cnv) on various Windows operating systems allows remote attackers to cause a denial of service (crash) a… | Patch early | 7.5 high | 44.6% | 2003-08-07 |
| CVE-2019-11932 EXP | A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp fo… | Patch early | 8.8 high | 44.5% | 2019-10-03 |
| CVE-2016-3301 EXP | The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and… | Patch early | 7.8 high | 44.5% | 2016-08-09 |
| CVE-2007-2167 EXP | Static code injection vulnerability in process.php in AimStats 3.2 allows remote attackers to inject PHP code into config.php via the number parameter… | Patch early | 7.5 high | 44.4% | 2007-04-22 |
| CVE-2015-5562 EXP | Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.19… | Patch early | 10.0 high | 44.4% | 2015-08-14 |
| CVE-2007-3111 EXP | Buffer overflow in the Provideo Camimage ActiveX control in ISSCamControl.dll 1.0.1.5, when Internet Explorer 6 is used on Windows 2000 SP4, allows re… | Patch early | 10.0 high | 44.4% | 2007-06-07 |
| CVE-2018-16299 EXP | The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. | Patch early | 7.5 high | 44.4% | 2018-09-24 |
| CVE-2018-11510 EXP | The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by… | Patch early | 9.8 critical | 44.3% | 2018-06-28 |
| CVE-2005-3792 EXP | Multiple SQL injection vulnerabilities in the Search module in PHP-Nuke 7.8, and possibly other versions before 7.9 with patch 3.1, allows remote atta… | Patch early | 7.5 high | 44.3% | 2005-11-24 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt